A malicious extension impersonating Anthropic's Claude Code appeared in the extension marketplace used by the AI code editor Cursor. It stayed available for roughly eleven hours on Thursday. According to Cursor's public statement, up to 5,000 users could have downloaded it. Anthropic did not build or publish the extension, so this is a case of a trusted AI brand being used as bait rather than a flaw in Anthropic's own software.

What the extension did

Cursor says the tampered package tried to gather basic system fingerprint data from affected machines: the hostname, the username, the operating system, and the public IP address. That kind of information is commonly used to profile targets and decide who is worth attacking further. The extension also tried to install a way for the attacker to access the machine remotely. Cursor notes that this step needs administrator rights, which most developer setups do not grant to an editor extension by default, so on most machines it likely failed. Still, anyone who ran it with elevated privileges could have been exposed to a deeper compromise.

Cursor's response

Once the problem was found, Cursor removed the extension and then took the entire marketplace offline rather than relying on a narrow takedown. The company says it worked with providers to neutralize the malware and confirmed there was no remaining risk before bringing the marketplace back. Cursor also states that its review found no other extensions affected. Pulling the whole marketplace is a conservative step. It costs availability, but it limits the chance of further installs while the scope is still unclear.

Why this matters for AI developer tooling

Cursor is a fork of VS Code and relies on a VS Code-style extension ecosystem. AI coding tools like Claude Code, GitHub Copilot and others are among the most downloaded extension categories right now, which makes them attractive for impersonation. Developers actively search for and install integrations for the newest agents, and they often grant them broad access to source code, terminals, environment variables and credentials. A fake extension that carries a well-known AI brand name therefore has a strong chance of being installed quickly and with little scrutiny.

The incident also highlights a structural weakness. Editors that are forks of VS Code often cannot use Microsoft's official marketplace and instead depend on alternative registries. Those registries may have different vetting, publisher verification and monitoring than the original. When one of them lets through a look-alike extension, the editor vendor ends up responsible for incident response even though the impersonated company, here Anthropic, had nothing to do with it.

Practical takeaways

Users who installed a Claude Code extension in Cursor around the time of the incident should check whether the publisher is the legitimate one and consider removing any suspicious package. They should also review whether any unexpected remote-access tools or accounts have appeared on their system. Teams should treat AI coding extensions like any other software supply chain dependency: verify publisher identity, avoid running the editor with administrator rights, and limit what credentials are available in the development environment.

Industry implications

For Cursor, the quick takedown and transparent public statement help limit reputational damage, but the episode will raise questions about how marketplace uploads are screened. For Anthropic, the brand impersonation shows how popular Claude Code has become, and it may encourage more explicit guidance on official installation channels. More broadly, as AI agents gain deeper access to developer machines, attackers will keep targeting the distribution channels around them. Expect marketplace operators to tighten verification, add publisher badges and run more automated scanning of newly uploaded extensions.